Career Ops UI

v1.99.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 21d Productivity & Wikis

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

airbnb-style ashby ats career-ops claude-code cv

+11 more

express greenhouse-api hh-ru job-application job-search lever local-first no-telemetry resume self-hosted sse

Affected surfaces

auth rce_ssrf

Summary

AI summary

Portals health page added to monitor watched companies and bug‑reporter now catches network errors and redacts unlabelled secrets.

Full changelog

[1.99.0] — 2026-07-05

Portals health page (#/portals). The scanner watches a set of companies in portals.yml (tracked_companies:), and an ATS slug can quietly break — a company renames its board or moves off Greenhouse — after which that employer silently vanishes from every future scan with no error. The new Portals page lists every watched company (provider + enabled state) and, on Check portal health, HEAD/GET-probes each careers_url through the DNS-pinned safeGet (SSRF-safe, chunked concurrency) and flags the dead ones (a 404 = silently dropped). Read-only — it never writes portals.yml.

New route server/lib/routes/portals.mjs (POST /api/portals/health; the company list reuses the existing GET /api/portals) + view public/js/views/portals.js, under the Sourcing nav group. #/portals was promoted from a config alias to a real registered view (router alias removed). Suite tests/portals-routes.test.mjs + updated tests/router.test.mjs. 14 new i18n keys ×16.
Bug-reporter hardening (v1.98.0 follow-up, per review): logbuf.js's fetch wrapper now has a .catch so network-layer failures (offline/DNS/abort — the failures a bug reporter most wants) reach the ring buffer; bug-report.js's scrubber now redacts bare/unlabelled provider keys (sk-ant-, sk-, ghp_, xoxb-, AIza…), not only labelled ones. +3 scrub assertions.

New: server/lib/routes/portals.mjs; public/js/views/portals.js.

Security Fixes

Bug‑reporter hardening: added catch for fetch errors and expanded secret redaction to include unlabelled keys (`sk-ant-`, `sk-`, `ghp_`, `xoxb-`, `AIza…`).

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Career Ops UI

Get notified when new releases ship.

About Career Ops UI

All releases →